Documentation
¶
Index ¶
- Constants
- Variables
- func Authorize(identity types.Identity, reqCtx policy.RequestContext) policy.Decision
- func AuthorizeSplit(identity types.Identity, reqCtx policy.RequestContext) (identityDecision, sessionDecision policy.Decision, hasSessionPolicy bool)
- func CORS(allowOrigin string) fiber.Handler
- func CallerArn(identity types.Identity) string
- func DebugLogger() fiber.Handler
- func EnsureRequestID(ctx fiber.Ctx) string
- func GlobalErrorHandler(ctx fiber.Ctx, er error) error
- func IdentityConditionContext(identity types.Identity) map[string][]string
- func PrincipalConditionArn(identity types.Identity) string
- func RateLimiter(limit int) fiber.Handler
- func RequestIDs() fiber.Handler
- func StackTraceHandler(ctx fiber.Ctx, e any)
- func ValidateDateAt(date, now time.Time) error
- func VerifyIAMAuth(service string, root *RootCredentials, store iamutil.IdentityStore) fiber.Handler
- func VerifyIAMPolicy(store iamutil.IdentityStore, oidcPolicy iamutil.OIDCEndpointPolicy) fiber.Handler
- func VerifyRootOnlySigV4(service string, root *RootCredentials) fiber.Handler
- type RootCredentials
Constants ¶
const HeaderAmznRequestID = "x-amzn-RequestId"
const (
SigningRegion = "us-east-1"
)
Variables ¶
var IdentityConditionKeyPrefixes = []string{
"aws:PrincipalArn",
"aws:PrincipalAccount",
"aws:PrincipalType",
"aws:username",
"aws:userid",
"aws:PrincipalTag/",
"aws:ResourceTag/",
"iam:ResourceTag/",
"aws:RequestTag/",
"aws:TagKeys",
}
IdentityConditionKeyPrefixes lists the condition-key namespaces that describe the caller or the resource, and that therefore only the IAM service may populate. handleEvaluatePolicy strips every one of them from a gateway-supplied context before overlaying its own — an override-on-collision merge would leave any key the service happens *not* to set (aws:PrincipalTag/x for an untagged role, say) under the gateway's control, which is exactly what a StringNotEquals-guarded Allow keys off.
Functions ¶
func Authorize ¶
Authorize reports how identity's own inline policies and, for a session with a session policy attached, the narrowing session policy as well, decide reqCtx.
A session policy can only narrow, never widen, what the role's identity policies otherwise allow — matching AWS's permission-boundary semantics for AssumeRole session policies — so this is an intersection, not the "either source is independently sufficient" combination VerifyAccess uses for S3 bucket-policy-vs-identity-policy: an explicit Deny from either layer here always wins outright, and the result is DecisionAllow only when both layers (or just the identity layer, absent a session policy) independently reach DecisionAllow.
func AuthorizeSplit ¶
func AuthorizeSplit(identity types.Identity, reqCtx policy.RequestContext) (identityDecision, sessionDecision policy.Decision, hasSessionPolicy bool)
AuthorizeSplit reports the identity-policy and session-policy decisions separately, rather than folded together as Authorize does, plus whether a session policy applied at all.
The two must stay separable for the S3 data plane, where a *resource* policy is also in play. A session policy filters everything, including permissions that came from the bucket policy rather than from the role with a role carrying no identity policy at all, a bucket policy granting s3:GetObject and s3:PutObject to that role, and a session policy allowing only s3:GetObject, the Get succeeds and the Put is denied. Collapsing the two into one decision here would lose the distinction between "the session policy did not permit this" (which must deny even against a bucket-policy Allow) and "the role's own policies did not permit this" (which a bucket-policy Allow may still grant).
func CORS ¶
CORS answers browser preflights and stamps the CORS headers onto cross-origin responses, so the WebUI can call this API from its own origin. Register it only when the operator configured an allowed origin; left unregistered, the API stays usable by CLI and SDK clients but no browser.
func CallerArn ¶
CallerArn identifies identity the way real IAM error messages do: the user's own Arn, or the assumed-role session Arn.
func DebugLogger ¶
DebugLogger returns a middleware that logs full request and response details when debug logging is enabled.
func EnsureRequestID ¶
EnsureRequestID returns the existing request ID from the context, or generates and stores a new one if none exists. It always sets the x-amzn-RequestId response header.
func GlobalErrorHandler ¶
GlobalErrorHandler is the fiber error handler for the IAM API server. It translates APIError values into XML responses and logs unexpected errors.
func IdentityConditionContext ¶
IdentityConditionContext builds the condition keys that describe *who* is calling — as opposed to the request-derived keys (time, source IP, transport) that its callers add around it.
Splitting these out is what lets the standalone-IAM private evaluate-policy endpoint serve the S3 gateway: the gateway knows the request but not the identity behind the access key, so it sends only the request-derived keys and this side fills in the rest from the identity it resolved. The gateway is never trusted to supply these keys itself, even though it authenticates as root.
func PrincipalConditionArn ¶
PrincipalConditionArn identifies identity the way the aws:PrincipalArn condition key does, which is not the way an error message does: for a session it is the assumed *role's* ARN, not the session's own. A Condition on aws:PrincipalArn therefore applies to every session of a role and can never single one out — aws:userid, which carries <role id>:<session name>, is the key that can.
func RateLimiter ¶
RateLimiter returns a middleware that limits concurrent in-flight requests to limit. Excess requests receive a Throttling error response immediately.
func RequestIDs ¶
RequestIDs is a middleware that ensures every request has a request ID set and returned in the response header.
func StackTraceHandler ¶
StackTraceHandler stores the panic value in the request context so that the global error handler can distinguish panics from regular errors.
func ValidateDateAt ¶
ValidateDateAt checks that date is within the allowed window relative to now. Exported so tests can exercise it directly.
func VerifyIAMAuth ¶
func VerifyIAMAuth(service string, root *RootCredentials, store iamutil.IdentityStore) fiber.Handler
VerifyIAMAuth authenticates a request against service (sigv4auth.ServiceIAM or sigv4auth.ServiceSTS).
Three kinds of credential are accepted: the configured root user, a long-term (AKIA…) IAM user access key, or a temporary (ASIA…) session minted by AssumeRoleWithWebIdentity. Whichever it is, the resolved identity (and, for a user/session, its policy documents) is stored via httpctx.ContextKeyCallerIdentity for the policy middleware and controllers to read back. Root bypasses the policy middleware entirely
func VerifyIAMPolicy ¶
func VerifyIAMPolicy(store iamutil.IdentityStore, oidcPolicy iamutil.OIDCEndpointPolicy) fiber.Handler
VerifyIAMPolicy authorizes an IAM action against the caller identity VerifyIAMAuth already resolved and stored via httpctx.ContextKeyCallerIdentity. Root bypasses this entirely. A long-term user is authorized by its own inline policies. A session is authorized by its assumed role's inline policies, additionally filtered by its own session policy if one was supplied — the session policy can only narrow, never widen, what the role otherwise allows: Effective permissions = Role identity-based permissions ∩ Session policy permissions.
Authorization is evaluated as a full request context — action, resource, and condition — rather than action alone: store resolves the actual target resource's ARN (for actions naming an existing user/role/OIDC provider) so a Resource-scoped statement only grants what it names, and requestConditionContext supplies the request's aws:SourceIp/aws:username/ aws:PrincipalArn/aws:CurrentTime/aws:EpochTime values for a statement's Condition block.
func VerifyRootOnlySigV4 ¶
func VerifyRootOnlySigV4(service string, root *RootCredentials) fiber.Handler
VerifyRootOnlySigV4 authenticates a request as strictly the configured root credential — used by the standalone IAM service's private endpoints, which only the S3 gateway itself ever calls, signing as its own configured IAM-client identity (root, or a dedicated IAM-access credential that defaults to root). Unlike VerifyIAMAuth, any other access key — valid IAM user, session, or unknown — is rejected outright before any signature work: there is no identity to resolve on behalf of here, and these two endpoints exist specifically so no identity other than the gateway's own ever needs to reach them.
Source Files